Sophos Enterprise Console
166
7.6 Configuring the full disk encryption policy
7.6.1 About full disk encryption
Note: This feature is not included with all licenses. If you want to use it, you might need to change your license. For more information, see http://www.sophos.com/en-us/products/complete/comparison.aspx
.
Full disk encryption protects the data on endpoint computers from being read or changed by unauthorized persons. Volumes on disks are encrypted transparently. Users do not need to decide what data is to be encrypted. Encryption and decryption are performed in the background.
By default, computers protected by full disk encryption run the Power-on Authentication (POA) before the operating system starts. After the user has logged on at the Power-on Authentication, the operating system starts and the user is logged on to Windows.
For convenient access, full disk encryption offers several features that aid IT operations on endpoint computers:
■
The Power-on Authentication can be temporarily deactivated for Wake on LAN, for example to facilitate patch management.
■
Normally, the first user who logs on to an endpoint computer after the encryption software has been installed, activates the Power-on Authentication. You can configure Windows accounts for logon to endpoint computers without activating the Power-on Authentication. This helps members of the IT team, for example, rollout operators. With the Windows accounts you specify in the full disk encryption policy as Power-on Authentication exceptions, they can log on to new computers for installation and verification tasks before end users log on and activate the
Power-on Authentication.
■
You can configure a POA user account to a member of the IT team to log on to endpoint computers for administrative tasks when the Power-on Authentication is already active.
For recovery on computers protected by full disk encryption, the following logon recovery methods are available:
■
■
Challenge/Response helps users who cannot log on to their computers or access encrypted data. A Challenge/Response procedure involves the assistance of a help desk. During the
Challenge/Response procedure, the user provides a challenge code generated on the endpoint computer to the help desk officer. The help desk officer then generates a response code that authorizes the user to perform a specific action on the computer. For more information, see
Recover access with Challenge/Response
(page 217).
With Local Self Help users who have forgotten their password can log on at their computer without the assistance of a help desk. Users log on by answering predefined questions in the
Power-on Authentication. Local Self Help reduces the number of help desk calls and allows help desk staff to concentrate on more complex support requests. For more information, see
Recover access with Local Self Help (page 218).
Important: Do not delete from the console computers that have been encrypted. Encryption recovery may not be possible in this case.
For more information about the recommended settings for full disk encryption, see the Sophos
Enterprise Console policy setup guide.
Help
For information about viewing events logged for computers protected by full disk encryption, see
View encryption events
(page 197).
7.6.2 Configure full disk encryption
Caution: If you are installing the Sophos encryption software for the first time, we strongly recommend that you enable and test each setting step-by-step.
If you use role-based administration:
■
You must have the Policy setting - full disk encryption right to edit a full disk encryption policy.
■
You cannot edit a policy if it is applied outside your active sub-estate.
For more information, see
About roles and sub-estates (page 20).
By default, full disk encryption is not enabled.
To enable and configure full disk encryption:
1. Check which full disk encryption policy is used by the group or groups of computers you want to configure.
See
Check which policies a group uses
(page 33).
2. In the Policies pane, double-click Full disk encryption. Then double-click the policy you want to change.
The Full disk encryption dialog box is displayed.
3. Under Volumes to encrypt, specify which volumes you want to encrypt by selecting the relevant check box(es):
■
■
Boot volumes
Non-boot volumes
4. Select Fast initial encryption (only encrypts used space on a drive) to reduce the time needed for initial encryption on endpoint computers.
Note: The fast initial encryption mode leads to a less secure state if a disk has been in use before encryption is applied. Unused sectors may still contain data.
5. Click OK.
When you assign the full disk encryption policy with these settings to a group of computers with the latest Sophos encryption software installed, the encryption process starts once the policy is received. The user can carry on working.
Note: To decrypt computers, clear the relevant options under Volumes to encrypt and assign the policy to the group of computers to be decrypted. Users are then allowed to manually decrypt the respective drives.
167
Sophos Enterprise Console
7.6.3 Configure logon
If you use role-based administration:
■
You must have the Policy setting - full disk encryption right to edit a full disk encryption policy.
■
You cannot edit a policy if it is applied outside your active sub-estate.
For more information, see
About roles and sub-estates (page 20).
By default, computers that use a full disk encryption policy are protected by Power-on
Authentication.
To configure how users log on at the Power-on Authentication on their computers:
1. Check which full disk encryption policy is used by the group or groups of computers you want to configure.
See
Check which policies a group uses
(page 33).
2. In the Policies pane, double-click Full disk encryption. Then double-click the policy you want to change.
The Full Disk Encryption dialog box is displayed.
3. Go to Power-on Authentication (POA).
4. Make sure that Enable Power-on Authentication is selected.
In addition, you can specify Windows accounts that can log on to endpoint computers for post-installation tasks without activating the Power-on Authentication: a) Click the Exceptions button next to the Enable Power-on Authentication field.
The Exceptions dialog box is displayed.
b) Click Add, enter the User name and the Computer or Domain Name of the relevant
Windows account(s) and click OK.
Note: In the fields User name and Computer or Domain Name you can use wildcards as the first or last character. In the User name field, the ? character is not allowed. In the
Computer or Domain Name field, the characters / \ [ ] : ; | = , + ? < > " are not allowed.
5. Select Fingerprint, to enable users to log on with Lenovo Fingerprint Reader.
6. To specify a user who can log on to the endpoint computer for administrative tasks when the
Power-on Authentication is already active, select POA user and click the Configure button.
a) In the Configure POA User dialog box, enter a logon name of your choice for the POA user in the User name field. You can freely define the logon name, with the following exceptions:
Note: In the User name field, the characters / \ [ ] : ; | = , + ? < > " * are not allowed.
Note: When setting up and entering logon names for POA users in Japanese, you have to use Romaji (Roman) characters to successfully log on at the POA.
b) Click the Set button next to the Password field.
168
Help
The POA User Password dialog box is displayed.
c) Enter and confirm a password for the POA user account and click OK.
Note: When setting up and entering passwords for POA users in Japanese, you have to use Romaji (Roman) characters to successfully log on at the POA.
d) In the Configure POA User dialog box, click OK.
7. To configure the temporary deactivation of the Power-on Authentication for Wake on LAN, select Temporary deactivation (for Wake on LAN).
For more information, see Configure temporary POA deactivation for Wake on LAN
(page 169)
8. In the Full Disk Encryption dialog box, click OK.
Note: If you clear Enable Power-on Authentication, you are prompted to confirm if you want to disable Power-on Authentication or not. For security reasons, we strongly recommend that you click No to keep Power-on Authentication enabled. Deactivating Power-on Authentication reduces system security to Windows logon security and increases the risk of unauthorized access to encrypted data.
7.6.4 Configure temporary POA deactivation for Wake on LAN
If you use role-based administration:
■
You must have the Policy setting - full disk encryption right to edit a full disk encryption policy.
■
■
You cannot edit a policy if it is applied outside your active sub-estate.
In the full disk encryption policy, the Enable Power-on Authentication field must be selected.
For more information, see
About roles and sub-estates (page 20).
By default, computers who use a full disk encryption policy are protected by Power-on
Authentication. You can temporarily deactivate the Power-on Authentication for Wake on LAN, for example to facilitate patch management. Wake on LAN is activated by running the scheduling script SGMCMDIntn.exe on the endpoint computer.
Note: Deactivating the POA - even for a limited number of boot processes - reduces the level of security of your system.
1. Check which full disk encryption policy is used by the group or groups of computers you want to configure.
See
Check which policies a group uses
(page 33).
2. In the Policies pane, double-click Full disk encryption. Then double-click the policy you want to change.
The Full Disk Encryption dialog box is displayed.
3. Under Power-on Authentication (POA), make sure that the Enable Power-on Authentication field is selected.
4. Select Temporary deactivation (for Wake on LAN) and click the Configure button.
The Configure Temporary Deactivation dialog box is displayed.
169
Sophos Enterprise Console
5. In the Start and End fields, specify the start and end time for the Wake on LAN process.
6. Select Allow Windows logon during this time to permit Windows logon during Wake on
LAN, for example for software updates.
7. In the Auto logon limit field, specify how often the computer is restarted without authentication through the Power-on Authentication during Wake on LAN.
Note: We recommend that you allow three more restarts than necessary in case of any problems.
8. Click OK.
7.6.4.1 Wake on LAN example
For a software rollout planned between 03:00 am and 06:00 am on a specific date, two restarts are required. The local software rollout agent must be able to log on to Windows.
In the full disk encryption policy, under Temporary deactivation (for Wake on LAN) you configure the following settings:
Policy setting
Start
End
Allow Windows logon during this time
Auto logon limit
Value
Day before software rollout, 12:00 noon
Day of software rollout 06:00 am
Yes
5
As the auto logon limit is set to 5 the endpoint computer starts 5 times without authentication through POA.
Note: In this example, the autologon limit is set to 5 as we recommend that you allow three more restarts than necessary in case of any problems.
By setting the start time to 12:00 noon on the day before the software rollout, you make sure that the scheduling script SGMCMDIntn.exe is started in time and that the Wake on LAN process starts no later than 03:00 am on the day of the software rollout.
The following two commands have to be created for the scheduling script SGCMDIntn.exe by the software rollout team:
■
■
Start on the day before software rollout, 12:15 am, SGMCMDIntn.exe -WOLstart
Start on the day after the software rollout, 09:00 am, SGMCMDIntn.exe -WOLstop
The date of the software rollout script is defined as the day of the rollout, 03:00 am. Wake on LAN can explicitly be deactivated again at the end of the script with SGMCMDIntn.exe -WOLstop.
All endpoint computers that log on before the date specified for Start and connect to the rollout servers receive the new policy and the scheduling commands.
170
Help
Any endpoint computer on which the schedule triggers the command SGMMCMDIntn -WOLStart between the day before the rollout at 12:00 noon and the day of the rollout at 06:00 am falls within the WOL time interval. Therefore Wake on LAN is activated.
7.6.5 Configure Challenge/Response
If you use role-based administration:
■
You must have the Policy setting - full disk encryption right to edit a full disk encryption policy.
■
■
You cannot edit a policy if it is applied outside your active sub-estate.
In the full disk encryption policy, the Enable Power-on Authentication field must be selected.
For more information, see
About roles and sub-estates (page 20).
Challenge/Response helps users who cannot log on to their computers or access encrypted data.
A Challenge/Response procedure involves the assistance of a help desk.
To configure Challenge/Response:
1. Check which full disk encryption policy is used by the group or groups of computers you want to configure.
See
Check which policies a group uses
(page 33).
2. In the Policies pane, double-click Full disk encryption. Then double-click the policy you want to change.
The Full Disk Encryption dialog box is displayed.
3. Under Power-on Authentication (POA), make sure that the Enable Power-on Authentication field is selected.
4. Under Logon recovery methods, make sure that Challenge/Response (help desk needed) is selected.
5. Click the Configure button next to Challenge/Response (help desk needed).
The Configure Challenge/Response Welcome Text dialog box is displayed.
6. In the text field, you can enter text that is displayed when the user initiates a
Challenge/Response procedure in the Power-on Authentication. For example: "Please contact the help desk on the phone number 1234-56789." After you have entered the text click OK.
7. Click OK.
7.6.6 Configure Local Self Help
If you use role-based administration:
■
■
You must have the Policy setting - full disk encryption right to edit a full disk encryption policy.
You cannot edit a policy if it is applied outside your active sub-estate.
■
■
To configure global settings for Local Self Help, you must have the right Global encryption
settings.
In the full disk encryption policy, the Enable Power-on Authentication field must be selected.
171
Sophos Enterprise Console
For more information, see
About roles and sub-estates (page 20).
With Local Self Help, users who have forgotten their password can log on to their computers without the assistance of a help desk. Users log on by answering predefined questions in the
Power-on Authentication.
To configure Local Self Help:
1. Check which full disk encryption policy is used by the group or groups of computers you want to configure.
See
Check which policies a group uses
(page 33).
2. In the Policies pane, double-click Full disk encryption. Then double-click the policy you want to change.
The Full Disk Encryption dialog box is displayed.
3. Under Power-on Authentication (POA), make sure that the Enable Power-on Authentication field is selected.
4. Under Logon recovery methods, select Local Self Help (without help desk) and click OK.
5. To configure further settings for Local Self Help, click Global Encryption Settings.
The Global Encryption Settings dialog box is displayed.
6. Under Local Self Help, configure the following settings: a) In the The user has to answer: drop-down list, select how many questions users must answer correctly to log on.
b) To allow users to define their own questions, select Allow users to define their own
questions.
7. Click OK.
7.6.7 Configure global encryption settings
If you use role-based administration, you must have the right Global encryption settings.
For more information, see
About roles and sub-estates (page 20).
Besides the settings in full disk encryption policies you can configure global encryption settings: display settings, global settings for Local Self Help and logging settings.
To configure global encryption settings:
1. In the Policies pane, double-click Full disk encryption. Then double-click the policy you want to change.
The Full Disk Encryption dialog box is displayed.
2. Click Global Encryption Settings.
The Global Encryption Settings dialog box is displayed.
172
